September 30, 2025
Ransomware detection and file restoration for Google Drive available in beta
What’s changing
We’re adding two new features to help organizations minimize the impact of ransomware attacks on personal computers. Specifically, we are adding these features in beta:
- Ransomware detection: When users have Google Drive for desktop installed on their computers, file syncing will be paused when ransomware is detected. The user will see a notification appear on their computer. Admins will see an alert in the Admin console security center. And notification emails will be delivered to both users and admins.
- File restoration: Users are able to restore their files to a previous version in Drive with ease, saving them time and money without paying a ransom. Users can select and restore multiple files prior to when ransomware infected their computer, making their files inaccessible.
Getting started
Admins:
- Ransomware detection will be on by default for users in your organization. You can turn it on or off at the OU level by going to Admin console > Apps > Google Workspace > Settings for Drive and Docs > Malware and Ransomware. If ransomware is detected for your users, admins will receive an email and get an alert in the Alert center.
- Drive file restoration will be on by default. You can turn it on or off at Admin console > Apps > Google Workspace > Settings for Drive and Docs > Drive file restoration.
- Install the latest version of Drive for desktop on user computers (v.114 or later) to enable the detection alerts (syncing will still be paused on older versions).
- Visit the Help Center to learn more about managing ransomware detection and file restoration for your organization.
The Admin console setting for ransomware detection
The Admin console setting for Drive file restoration
Email to admins when potential ransomware is detected
Admin alert in the Alert center with information on the potential ransomware detection
Alert detail on the ransomware detection
End users:
- The availability of this feature will depend on your admin’s settings. If turned on and ransomware is detected, you will see the alerts and access the interface below.
- Use the Help Center to learn more about restoring files in bulk with Google Drive.
End user alert in Drive for desktop when ransomware is detected
Interface to assist with file recovery
Rollout pace
Admin console setting
- Rapid and Scheduled Release domains: Full rollout (1–3 days for feature visibility) starting on September 30, 2025.
File detection and restoration features
- Rapid and Scheduled Release domains: Gradual rollout (up to 15 days for feature visibility) starting on October 14, 2025.
Availability
File restoration
- Available to all Google Workspace customers, Workspace Individual Subscribers, and users with personal Google accounts
Ransomware detection
Available for Google Workspace:
- Business Standard, Plus
- Enterprise Starter, Standard, Plus
- Education Standard and Plus
- Frontline Standard and Plus
Resources
- Google Workspace Admin Help: Detect ransomware and recover files in Drive for desktop
- Google Help: Restore files in bulk with Google Drive
- Workspace blog: Block ransomware proliferation and easily restore files with AI in Google Drive